Unscored severity · published Oct 4, 2011
CVE-2011-3978
Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy.php in LightNEasy 3.2.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1)…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy.php in LightNEasy 3.2.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) commentemail, (2) commentmessage, or (3) commentname parameter in a sendcomment action for the news page.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Lightneasy · Lightneasy
3.2.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-3978
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-3978
osvdb.org
http://osvdb.org/75262
Vendor Advisory
http://secunia.com/advisories/45955
securityreason.com
http://securityreason.com/securityalert/8407
Exploit
http://www.lightneasy.org/punbb/viewtopic.php?id=1464
Exploit
http://www.rul3z.de/advisories/SSCHADV2011-013.txt
www.securityfocus.com
http://www.securityfocus.com/archive/1/519571/100/0/threaded
More from Lightneasy
–
CVE-2010-4753
Cross-site scripting (XSS) vulnerability in LightNEasy.php in LightNEasy 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter, which is not…
–
CVE-2010-4752
SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the page…
–
CVE-2010-4751
SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the…
–
CVE-2010-3485
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the userhandle cookie to LightNEasy.php, a different…
–
CVE-2010-3484
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the handle parameter to LightNEasy.php, a different…